diff --git a/README.md b/README.md
index 1a2d252..1b55e7f 100644
--- a/README.md
+++ b/README.md
@@ -76,3 +76,4 @@ config reflector
 Use `list files '/path/to/reflectors.csv'` instead of `option files 'none'` to
 combine CSV files with inline reflectors. Omitting `files` keeps the default CSV;
 UCI discards empty string options, so `option files ''` does not disable it.
+Absent or blank `irtt_hmac` values use unauthenticated IRTT sessions.
diff --git a/src/measurement/irtt.rs b/src/measurement/irtt.rs
index e410f02..ac24058 100644
--- a/src/measurement/irtt.rs
+++ b/src/measurement/irtt.rs
@@ -119,7 +119,7 @@ impl IrttEngine {
                     TargetId::new(binding.stream.id.0.to_string()),
                     SocketAddr::new(binding.stream.peer, binding.port).to_string(),
                 );
-                if let Some(key) = &binding.hmac {
+                if let Some(key) = binding.hmac.as_ref().filter(|key| !key.trim().is_empty()) {
                     target.auth = TargetAuth::Override(irtt_client::Authentication::Hmac(
                         irtt_client::HmacKey::new(key.as_bytes().to_vec().into_boxed_slice()),
                     ));